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Before the Honorable Paul M. Warner, United States Chief Magistrate Judge for the 
District of Utah, appeared the undersigned, who on oath deposes and says : 

AGENT INTRODUCTION 

1, I am a Special Agent of the Federal Bureau of Investigation (FBI). I entered on duty as a 
Special Agent with the FBI on August 3, 1997. Prior to joining the FBI, I graduated from the 
New England School of Law in Boston, Massachusetts, and am currently an active member of 
the Utah State Bar. I am also a member of the United States Supreme Court Bar. During my 
twenty years with the FBI, I have served as a Special Agent, a Supervisory Special Agent, a 
Legal Instructor, and Legal Advisor. As such, I have conducted multiple national security 
investigations, which have involved violations of federal law. Additionally, I have written 
affidavits, executed search warrants, interviewed victims, interviewed suspects, and conducted 
arrests. I also served for five years at the FBI Academy where I taught Constitutional Law, 
Criminal Law, Criminal Procedure, and National Security Law to Special Agents and other law 
enforcement officers from around the United States. As a Special Agent, I am authorized to 
investigate violations of the laws of the United States and execute warrants issued under the 
authority of the United States. 

2. The statements contained in this affidavit are based on written and oral information 
provided by other law enforcement investigators assigned to this case, on information provided 
by confidential sources, on information contained in records obtained by investigators, and on 
my own training, experience, and background. Since this affidavit is being submitted for the 
limited purpose of obtaining a criminal complaint, not every fact concerning the investigation 
has been included, but only the facts necessary to establish a foundation for an arrest warrant on 
the charges alleged in this complaint. 
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BACKGROUND 

Affiant is aware that at all times material to this Complaint: 

The United States Intelligence Community 

3. The United States Intelligence Community (USIC) consisted of U.S. executive branch 
agencies and organizations that worked separately and together to conduct intelligence activities 
necessary for the conduct of foreign relations and the protection of the national security of the 
United States. 

4. The U.S. Department of Defense (DoD) was a U.S. executive branch agency tasked with 
providing the military forces needed to deter war and to protect the security of the United States. 

5. The Defense Intelligence Agency (DIA) was a component of DoD and the 
USIC, which collected (including through classified means), analyzed, produced, and 
disseminated foreign intelligence and counterintelligence to support national and DoD missions. 
The DIA planned, managed, and executed intelligence operations during peacetime, crisis, and 
war. The DIA provided dcIciisen'elatexlTntelligcrrce for Lhu'Secrelary uf DcfenseTilieTnhaiTmarr 
of the Joint Chiefs of Staff, combatant commanders, other DoD components, and non-DoD 
agencies. Furthermore, the DIA conducted administrative and technical support activities within 

i 

and outside the United States as necessary for cover arrangements. Other DoD components of 
the USIC include U.S. Army Intelligence. 

6. The FBI was a U.S. government intelligence and law enforcement agency and was a 
component of the USIC. The FBI was responsible for, among other things, conducting 
counterintelligence investigations and activities. 
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Classified Information 

i 

7. National security information constituted information owned by, produced by, produced. 
for, and under the control of the United States government that related to the conduct of foreign 
relations or the national defense. Pursuant to Executive Order 13526 and its predecessors, 
national security information corresponded to three possible classification levels: 

a. Information was classified as TOP SECRET if the unauthorized disclosure of that 
information reasonably could be expected to cause exceptionally grave damage to the 
national security that the original classification authority was able to identify and 
describe. 

b. Information was classified as SECRET if the unauthorized disclosure of that 
information reasonably could be expected to cause serious damage to the national 
security that the original classified authority was able to identify and describe. 

c. Information was classified as CONFIDENTIAL if the unauthorized disclosure of that 
information reasonably could be expected to cause damage to the national security that 
the original classified authority was able to identify and describe. 

8. Only individuals determined eligible by an appropriate U.S. government official could 
lawfully access classified information. Additional requirements dictated that such an individual 
sign an approved non-disclosure agreement, receive a security clearance, and possess a “need to 
know” the classified information. Those authorities further required the storage of classified 
information in an approved facility and container commensurate with its classification level. 

9. Classification markings represented the usual means of communicating the need to protect 
classified national security information. Classified documents typically contained banners on the 
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top and bottom stating the highest level of classification and any additional controls associated 
with the materials, as well as markings relating to the information contained in each paragraph. 


10. In addition to classification markings, classified information at times contained 


dissemination markings which restricted the distribution of the information. 


These markings 


include “NF” or “NOFORN” dissemination control markings that stood for “No Foreign 


Dissemination.” The NOFORN marking denoted a limitation to disseminate the information 


only to U.S. persons. 


The People’s Republic of China Intelligence Services 

11. The People’s Republic of China intelligence services (PRCIS) encompassed both the 
civilian and military components of Chinese intelligence programs. Civilian intelligence 
agencies included the Ministry of State Security (MSS) and the Ministry of Public Security 
(MPS). The MSS consisted of a central mini stry, provincial state security departments, and 
municipal state security bureaus, such as the Beijing State Security Bureau (BSSB)“andlke 

Shanghai State Security Bureau (SSSB). The MPS was the principal domestic police and 
security agency. 

12. The MSS maintained primary responsibility for domestic counterintelligence, foreign 
intelligence, and aspects of political and military security. Among other things, the MSS and its 
regional bureaus focused on identifying and influencing the foreign policy of other countries, 
including the United States. The MSS and its bureaus sought to obtain information on military, 
political, economic, and security policies that might affect the People’s Republic of China 
(PRC), foreign intelligence operations directed at the PRC, and biographical profdes of foreign 
politicians and intelligence officers. Much of the PRC’s espionage efforts in industrialized 
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nations focused on acquiring technology that may or may not have been cleared for export. The 
PRCIS commonly used agents running front companies to purchase high-technology equipment. 

13. PRCIS human source operations tended to originate inside the PRC, where 

the PRCIS preferred to meet with its sources or assets. The PRCIS recruited individuals with 
direct and second-hand access to information. The PRCIS recruited, among others, individuals 
who traveled in and out of the PRC for business or study and who could return to their home 
country to gain employment in the national security system or exploit existing connections. The 

PRCIS commonly used money to recruit sources. 

The Defendant 

14. Ron Rockwell Hansen (HANSEN), a United States (U.S.) citizen, resided in Syracuse, 
Utah. HANSEN retired from the U.S. Army (Army) as a Warrant Officer with a background in 
signals intelligence and human intelligence. HANSEN spoke fluent Mandarin-Chinese and 
Russian. From approximately 2000 to 2006, while serving on active duty in the Army, 
HANSEN worked as an intelligence case officer for the DIA. He retired from the Army m early 
2006 after more than 20 years of service. Upon retirement, DIA hired HANSEN as a civilian 
intelligence case officer. While on active duty with the Army and while employed as a DIA 
civilian, HANSEN possessed a TOP SECRET security clearance. 

15. As part of the training to become a case officer, HANSEN received training in managing 
assets, deterring surveillance, avoiding detection, and handling classified and sensitive 
information. 
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16. HANSEN eventually resigned from DIA in December 2006, after which he became a 
member in two companies, H-l 1 Digital Forensics Company LLC and H-11 Digital Forensics 
Services LLC (hereinafter referred to collectively as H-l 1). FIANSEN’s primary responsibilities 
related to H-l 1 ’s business in Asia. From approximately 2007 until late 2011, HANSEN 
maintained office space and an apartment in the PRC and traveled frequently from Utah to the 
PRC. 

17. According to HANSEN, he partnered with two PRC nationals, whom he identified by 
anglicized names as “Amy” and “Robert,” at his H-l 1 office in Beijing. According to HANSEN, 
Robert maintained close connections to numerous contacts within PRCIS agencies. 

18. From approximately the end of 2000 until late 2011, HANSEN performed contract work 

for the U.S. government that provided HANSEN with additional access to classified national 
defense information. During his military service, the U.S. government entrusted HANSEN with 
access to sensitive government materials, including closely held national defense information 
and classified documents and materials. i — 

19. Between the years 2000 and 2011, HANSEN signed multiple agreements that he would 
not disclose his work with the U.S. government or the information derived from that relationship. 
Over his many years of holding security clearances, HANSEN received training regarding 
classified information, including the definitions of classified information, the levels of 
classification, as well as the proper handling, marking, transportation, and storage of classified 
materials. HANSEN received training on his duty to protect classified materials from 
unauthorized disclosure, which included complying with handling, transportation, and storage 
requirements. HANSEN received instruction that the unauthorized transportation and storage of 
those materials risked disclosure and that transmission of the information could endanger the 
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national security of the United States and the safety of its citizens. 

20. As a prerequisite to accessing classified information during his employment with the U.S. 
government agencies, HANSEN signed numerous contracts containing non-disclosure 
agreements in which he acknowledged both the harm that could result from the unauthorized 
disclosure of classified information and the applicability of criminal espionage laws should he 
make an unauthorized disclosure of such information or should he unlawfully retain such 
information. 

21. Beginning in early 2012, HANSEN attempted to regain access to national defense 
information by seeking positions of employment or confidence with USIC agencies, often 
through former DIA associates. 

a. In February of 2012, HANSEN approached U.S. Army Intelligence, through a former 
DIA associate, and offered to work as a double agent against the PRCIS. 


b. In May of 2012, HAN SEN also applied for a position with DIA. 

c. In mid-2013, in a meeting at DIA Headquarters facilitated by a high-ranking DIA 
officer, HANSEN suggested to a DIA analyst assigned to a classified program targeting 


the PRC that DIA operate HANSEN as a source. 

d. In November of 2013, when HANSEN’s efforts to gain access through those 
intelligence agencies failed, HANSEN approached another component of the U.S . Army 

v 

Intelligence through another former DIA associate. 


e. In February of 2015, HANSEN approached the FBI and offered to work as a double¬ 
agent against the PRCIS. 

f. In September of 2015, HANSEN contacted a United States House of Representatives 
member assigned to the House Permanent Select Committee on Intelligence, and 
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HANSEN proposed that he work as a member of the Representative’s staff on 


intelligence issues. 

g. In May of 2016, as set forth in more detail below, HANSEN reestablished contact 
with a current DIA case officer. In later meetings, HANSEN encouraged that DIA case 


officer to use HANSEN as a source against the PRCIS. 

22. At no time did HANSEN notify the Attorney General of the United States that he was 
acting as an agent for any foreign government, including the PRC. 

23. According to HANSEN’s financial records and his admissions to the FBI, between 2011 
and 2016, the following companies employed HANSEN after his work with the U.S. government 

ended: 
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Logicube 

Computer Forensics 

Hardware Manufacturer 

Director of 
Worldwide Sales 

September 2011 - July 2012 

Smith 

Electric 

Electric Vehicle Design and 

Pmrli i rti nri 

Contractor 

July 2014-March 2016 


| Vehicles 
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24. According to HANSEN’s financial records and business registration records, HANSEN 


possessed an ownership interest in the following entities: 
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AC-FPS 
Business 
Group LLG 

American 

Chinese 

Friendship 

Promotion 

Society 

57 W 200 S 
Suite 302 Salt 
Lake City,UT 

March 26, 
2013 

Owner 

Yes 

Wells 

Fargo 

x6750 

H-l 1 Digital 

Forensics 

Services 

LLC 

Computer 

Forensics 

Company 

57 W 200 S 
Suite 302 Salt 
Lake City.LT 

July 9, 2007 

Chief 

Executive 

Officer/ 

Owner 

Yes 

Wells 

Fargo 

x3972 

H-ll Digital 
Forensics 

Computer 
Forensics 
• Company 

57 W 200 S 
Suite 302 Salt 
Lake City.UT 

November 20, 
2006 

Chief 

Executive 

Officer/ 

Yes 

Wells 

Fargo 

x8498 


9 











































Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 10 of 41 


Company 

LLC 




Owner 


xl000 

Nuvestack 

LLC 

Cloud 

Computing 

Company 

600 17 th St 
Denver, CO 

November 19, 
2013 

Owner 

Yes 

Wells 

Fargo 

x0702 

Nuvestack 

Iiic. 

Cloud 

Computing 

Company 

57 W 200 S 
Suite 302 Salt 
Lake City,UT 

September 25, 
2015 

Owner 

Yes 

Wells 

Fargo 

x4721 


25. Nuvestack provided cloud computing IT services. American and Chinese Friendship 
Promotion Society Business Group (AC-FPS) provided a method through which HANSEN 
attempted to generate revenue by providing business services in the PRC. 

26. Between September of 2012 and the date of this Complaint, HANSEN had only 
intermittent periods of verifiable income. HANSEN’s military pension, which paid 
approximately $1,900 in net monthly income, constituted his only consistent source of income.' 

27. According to jointly-filed, personal tax returns for tax years 2013 through 2016, 
HANSEN claimed large losses from his affiliated partnerships, including Nuvestack, AC-FPS, 
and H-11, resulting in less than $40,000 in his gross adjusted income reported each year. For tax 
years 2013-2016, AC-FPS recorded business losses each year. Nuvestack filed its initial U.S. 
Return of Partnership Income for tax year 2013 and claimed $0.00 income and $64,002 in 

i 

expenses. According to Nuvestack’s U.S. Return of Partnership Income for tax year 2014, 
business losses claimed were -$1,114,889 with only $4,000 in gross receipts. Nuvestack failed 
to file taxes in 2015 and 2016 and carried significant debt. 

28. In addition to the financial strain caused by his ownership interests, between 2012 and the 
date of this Complaint, HANSEN’s personal unsecured debt ranged from $150,000 to $200,000. 
HANSEN exhausted his own credit limit and, as of late 2016, HANSEN began to borrow funds 
against credit cards belonging to his family members. 
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Meetings with the FBI 

29. In 2014, the FBI commenced an investigation into HANSEN’s activities. Throughout 
2015 , while unaware of the pending investigation, HANSEN participated in nine voluntary 
meetings with FBI agents in Salt Lake City, Utah. HANSEN claimed that he initiated the 
meetings with FBI in an attempt to offer his cooperation as a source. During those meetings, 
HANSEN described numerous encounters with PRCIS officials, and HANSEN disclosed that 

agents of the PRCIS targeted him for recruitment. 

30. HANSEN told the FBI that, by at least early 2014, he began meeting with two MSS 
officers known to him as “David” and “Martin.” HANSEN described meeting with David and 
Martin in private rooms in tea houses and hotels in Beijing, and explained that Robert set up 
those meetings. HANSEN related that during a business trip to the PRC in early 2015, David 
and Martin offered him $300,000 per year in exchange for providing “consulting services.” 
HANSEN reported that David and Martin asked him to attend conferences or exhibitions on 
forensics, information security, and military communications and to conduct product research. 
HANSEN stated that David and Martin gave him money by overpaying him for purchases of 
computer forensic products. 

31. In March of 2015, when asked how he could obtain information for the PRCIS, 
HANSEN told the FBI that he “could start going to Washington, D.C. and meeting with friends 
who are in the intelligence community and try and elicit classified info from them.” However, 
HANSEN acknowledged that doing so would constitute “alerting behavior.” Physical 
surveillance and court-authorized intercepted phone calls confirm that HANSEN began reaching 
out to former DoD and DIA associates that same year and continuing into 2016. Several of those 
associates had not had contact with HANSEN in many years. 
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32. In June and July of 2015, HANSEN gave the FBI two thumb drives containing several 
reports that he wrote and other materials he obtained during his work with the U.S. government. 
When asked by the agents how he safeguarded the material, HANSEN replied that he stored the 
material on external drives and maintained these drives in a safe in his home. The two thumb 
drives did in fact contain classified information that HANSEN was not authorized to retain. 

33. In December of 2015, in the final meeting with FBI agents, HANSEN reiterated his 
potential value to the PRCIS, suggesting the PRCIS could direct him to contact two specific DIA 
case officers in Texas and Georgia. At the conclusion of the meeting, FBI agents admonished 
HANSEN that he must not accept the MSS’s offer to work for them. The FBI agents further 
instructed HANSEN that he must inform the FBI if the PRCIS continued to contact him. At no 
point thereafter, despite his later admissions to others about his continual meetings with the 
MSS, did HANSEN report any further interaction with PRCIS to the FBI. As described more 
fully below, in May of 2016, HANSEN traveled to Texas and met with one of the DIA case 

officers he mentioned to the FBI in December 2015. 

Attending Conferences 

34. During the course of the investigation, the FBI learned that HANSEN began attending 
conferences on behalf of the PRC and its officials as early as 2013 and continued doing so 
through 2017. The FBI conducted surveillance of HANSEN at some of those conferences. FBI 
surveillance personnel observed HANSEN typing notes on his laptop computer and taking 
photographs of the presenters. 

35. From September 9-10, 2015, HANSEN attended the Intelligence & National Security 
Su mmi t in Washington, D.C. sponsored by the Intelligence and National Security Alliance 
(INS A) and the Armed Forces Communications and Electronics Association (AFCEA). From 
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April 20-22, 2016, HANSEN attended the AFCEA-sponsored Defense Cyber Operations 
Symposium in Washington, D.C. From September 7-8, 2016, HANSEN again attended the 
Intelligence & National Security Summit in Washington, D.C. From November 15-17,2016, 
HANSEN attended the AFCEA-sponsored TechNet Asia Pacific Conference in Honolulu, 
Hawaii. From September 6-7, 2017, HANSEN attended the Intelligence & National Security 


Summit in Washington, D.C. 

36. Although HANSEN registered for conferences under the name of Nuvestack Inc., he 
listed his home address rather than the Nuvestack address on registration documents. Recorded 


phone calls reveal that HANSEN attempted to conceal his attendance at the TechNet conference 
by asking a close Nuvestack associate not to disclose his location while at the conference. While 
at the conferences, HANSEN also affirmatively misrepresented to the Nuvestack president and 


other employees that he had been recalled to military duty. 


HANSEN’s Travel and Searches 

37. During the investigation, the FBI also monitored HANSEN’s travel. On several 
instances during the investigation, the FBI enlisted the assistance of officers from U.S. Customs 
and Border Protection (CBP) to assist with searching and questioning HANSEN as he traveled 
back to the U.S. from the PRC. Between 2014 and 2017, in each instance that officers from CBP 
searched HANSEN’S luggage or carry-on baggage, while he cleared customs on his travel back 
to Utah from the PRC, HANSEN carried currency and various digital devices, including cellular 
phones, smart phones, thumb drives, a laptop computer, and/or other digital storage media. 

38. HANSEN traveled to the PRC on June 30, 2014, and returned to the U.S. through the 
Detroit Metropolitan Airport on July 9, 2014. Upon his return, HANSEN knowingly failed to 
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report that he was carrying currency in excess of $ 10,000, and he failed to complete and submit a 
Report of International Transportation of Currency or Monetary Instruments (FINCEN Form 
105) as required. In Detroit, CBP conducted a secondary inspection of HANSEN’s carry-on 
luggage. When HANSEN realized that CBP intended to search his possessions, HANSEN told 
the CBP officer that he had failed to declare currency over $10,000. After the interaction with 
the CBP officer, HANSEN then disclosed that, in fact, he earned $19,222. HANSEN 
subsequently completed the required FINCEN Form 105. 

39. HANSEN traveled to the PRC on December 5, 2015, and he returned to the U.S. on 
December 14, 2015. Upon his return, a court-authorized search of HANSEN’s carry-on luggage 
revealed a passcode-protected thumb drive concealed behind a sock in the toe of a shoe. A 
forensic image of the thumb drive revealed the file names of photographs and notes related to the 
September 2015 INSA Summit. The forensic examination also revealed that the thumb drive 
had been accessed during HANSEN’s stay in the PRC.. HANSEN’s suitcase contained brochures 
and other materials related to the September 2015 INSA summiL. flic subcase also contained a— 
print-out establishing HANSEN’s membership in AFCEA starting in June of 2013. FIANSEN 
also carried his MacBook Pro computer and $53,000 in cash. HANSEN told CBP officers that 
the $53,000 represented proceeds from the sale of a Netwitness server; however, HANSEN 
could not produce any documentation to verify the sale of the product. 

40. On April 18, 2016, during HANSEN’s trip to Washington, D.C. to attend the AFCEA 
conference, the FBI conducted a court-authorized search of HANSEN’s hotel room and created a 
forensic image of FIANSEN’s MacBook Pro computer. One document found on the computer, 
saved under the file name “Business Development,” contained expenses related to HANSEN’s 
attendance at conferences, AFCEA membership renewal, and INSA membership. The Business 
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Development document also contained a list of names and contact information of former 
DoD/DIA associates of HANSEN. Several of the contacts continued to work for the United 
States government, including an individual who later began operating as a Confidential Human 
Source (“CHS”). The Business Development document also included names of U.S. politicians 
representing the State of Utah. HANSEN did not have any business dealings with the vast 
majority of the individuals listed in the document. Additionally, during the forensic 
examination, the FBI discovered printer file records indicating that, days before his trip to the 
PRC in December of 2015, HANSEN printed information from Linkedln related to several 
former and current DIA case officers. 

41. Other documents stored on the computer contained information about the U.S. military 
and other conferences that HANSEN previously attended, including information detailing U.S. 
Cyber Command locations, personnel, and organizational structure. 

42. HANSEN traveled to the PRC again on July 17, 2016, and he returned to the U.S. on July 
23, 2016. A court-authorized search of I lANSEN’s luggage when he returned revealed that he 

carried the same password-protected thumb drive with him as he had on December 14, 2015. A 
forensic examination revealed two documents located in the unallocated space on the thumb 
drive, evidencing an attempt to delete the documents. One document contained notes about the 
Defense Information Systems Agency, relating to the AFCEA conference HANSEN attended in 
April of 2016. The examination further revealed that the thumb drive had last been accessed on 
July 18, 2016, during HANSEN’s trip to the PRC. 

43. The other document started with an itemized list of expenses related to his May 2016 trip 
to Texas. The document also contained past and current locations of DIA facilities in San 
Antonio, as well as cryptic notes related to the classified program and DIA personnel, and 
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cryptic notes about a DIA case officer hiring initiative. The document also contained dates, 
titles, and locations of upcoming military, intelligence, and technology conferences. 

44. HANSEN traveled to the PRC again on December 14, 2017, and he .. • 

returned to the U.S. on December 19, 2017. Upon his return during customs processing, the FBI 
conducted a court-authorized search of HANSEN’s luggage and possessions. HANSEN carried 
a MacBook Air computer. A forensic examination of the computer revealed a document saved 
to the computer under the file name “Notes_INSA Summit2016.” The document contained 
several pages of extensive notes about the INSA Summit that HANSEN attended in Washington, 
D.C. in September of 2016, as well as cryptic notes about his meetings with three former DIA 
associates during that trip to Washington, D.C. 

45. The notes also included expenses related to HANSEN’s travel and attendance at the 
summit in Washington, D.C. The cryptic notes included the initials of the first and last names of 
the former DIA associates, the dates he met them, and other information likely related to his 
“discussions with them, including cryptic notes related to Iheiremployment, such as work with 
“special ops community” and a specific U.S. government intelligence agency. The cryptic notes 
also included the initials of the spouse of one of the former DIA associates and the date in July of 
2016, when HANSEN had a chance meeting with her while traveling in Japan. At the time, the 
spouse worked as a DIA employee. The cryptic notes also included the initials of the CHS with 
an August date, followed by the note “med board,” referring to discussions between HANSEN 
and the CHS about the CPIS’ medical condition and the CHS’ U.S. Army medical board status. 
The document also contained the date, title, and location of a November 2016 military, 
intelligence, and technology conference, which HANSEN attended. 

HANSEN’s Communications with PRCIS 
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46. HANSEN consistently touted his access to PRCIS intelligence officers throughout the 
2015 voluntary meetings with the FBI. As noted above, in February 2015, HANSEN described 
his ongoing meetings with MSS intelligence officers David and Martin, saying those meetings 
began in 2014 and continued into 2015. He explained that he stopped traveling to the PRC after 
December of 2011 while he was applying to return to work with DIA, but he resumed travel in 
April of 2013 upon learning he would not be hired. HANSEN described a succession of PRCIS 
intelligence officers with whom he met during visits to the PRC. He identified one of the 
officers as Max, who he said later introduced him to David and Martin, who he then began 
meeting with exclusively. 

47. In the next voluntary meeting with the FBI in March of 2015, HANSEN further described 
the PRCIS intelligence officer as' Max Tong, but said he was unsure if Tong was Max’s real last 
name. HANSEN said he met with Max and Martin in 2013. In the May 2015 voluntary meeting 
with the FBI, HANSEN again described various PRCIS intelligence officers with whom he met 
in the PRC over his years of travel. He admitted to using his personal email accounts, including 
his @ac-fps.org account, to communicate with certain PRCIS intelligence officers. He provided 
a sheet of paper with the names and contact information of some of the PRCIS intelligence 
officers. HANSEN identified Max on the sheet of paper he provided, which listed him as “Max 
Rain” with an email address @foxmail.com. He again identified Max as the PRCIS intelligence 
officer who introduced him to MSS intelligence officers David and Martin. In the September 
2015 voluntary meeting with the FBI, HANSEN provided another document listing his PRCIS 
contacts, including the years of contact and the officers’ affiliation. He identified Max Tong as 
an MSS intelligence officer assigned to “HUMINT,” an acronym for Human Intelligence, with a 
first meeting date of March 2011. 
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48. A court-authorized search of HANSEN’s email account related to the @ac-fps.org 
address revealed three email exchanges with Max using his @foxmail.com email account. One 
of HANSEN’s email responses to Max included a contact title of “Rain” for the @foxmail.com - 
email address, further showing these email exchanges were with Max Tong during 2012-13 . 

i 

49. The emails were sent in mid-2012 and early 2013, and they showed Max’s eagerness for 
HANSEN to resume travel to the PRC. In emails exchanged in July of 2012, HANSEN revealed 
to Max that he decided to go back to his job at the Department of Defense and he would not be 
able to travel to the PRC that month. At that time, HANSEN had applied for a position with 
DIA, which required a security clearance and would have given him renewed access to 

i 

intelligence reporting. Max sent another email to HANSEN in January of 2013, noting he 
looked forward to hearing from HANSEN. HANSEN replied in April of 2013, about the time he 
learned he would not be hired by DIA and right before his first trip back to the PRC since 
December of 2011, noting he had good news. He wrote that he would be in the PRC the 
following week',"adding that his schedule was busy so they would need to meet early in the 
morning. He added that he looked forward to seeing Max. HANSEN failed to disclose his 
ongoing contacts with Max, someone he knew to be a PRCIS intelligence officer, to DIA during 
his application and security clearance background check investigation. 

50. When HANSEN first approached the FBI in February of 2015, he explained that Robert 
set up his meetings with MSS intelligence officers David and Martin. At a subsequent voluntary 
meeting with the FBI in March of 2015, when HANSEN again stated that Robert brokered 
HANSEN’s meetings with David and Martin and other PRCIS intelligence officers, the FBI 
asked HANSEN about Robert’s background and why he had direct contact with PRCIS 
intelligence officers. HANSEN described Robert’s access to hundreds of PRCIS officers, adding 
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that Robert visited PRCIS offices, including the MSS office. At a subsequent voluntary meeting 
with the FBI in September of 2015, HANSEN explained that David and Martin opted to no 

longer utilize Robert to arrange meetings with HANSEN, but they instead gave HANSEN a.. 

XINDA-model PRC cell phone with Martin’s name and telephone number preprogrammed to 
allow HANSEN to co mm unicate directly with Martin to set up in-person meetings after 
HANSEN arrived in the PRC. 

51. The investigation revealed that, as early as July of 2014, HANSEN used various cell 
phones to communicate with Martin and others in the PRC. HANSEN’s use of multiple cell 
phones to communicate covertly with intelligence officers is consistent with case officer 
tradecraft training HANSEN received from DIA to communicate securely with human sources. 

52. When HANSEN returned from the PRC on July 9, 2014, CBP officers conducted a 
secondary inspection of HANSEN’s luggage and possessions and found an inexpensive NOKIA- 
brand, PRC cell phone. HANSEN also had a U.S. smartphone. 

-53. When HAN SEN re l umed f rom the PRC o ir Becembei 14, 2015, -t he -FBEconductedm- 

court-authorized search of his luggage and possessions and found an inexpensive XINDA-brand 
PRC cell phone packed in his cany-on luggage, which he possessed in addition to the U.S. and 
PRC smartphones he carried in his briefcase. - The XINDA phone had call data showing 
communications with “Martin.” 

54. Upon HANSEN’s return to the U.S. in July 23, 2016, following his travel to the PRC, the 
FBI conducted another court-authorized search of his luggage and possessions and found an 
inexpensive NOKIA-brand PRC cell phone packed in his carry-on luggage separate from his 
U.S. and PRC smartphones located in his briefcase. This NOKIA phone call data showed 
communications with “Martin.” This was not the same NOKIA-brand cell phone found in 
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HANSEN’s possession by CBP in July of 2014. 

55. On July 11, 2017, the FBI conducted a court-authorized search of HANSEN’s checked 

luggage prior to his flight to the PRC and found HANSEN’s Huawei-brand PRC smartphone. 

packed in the luggage. The FBI obtained a forensic image of the phone and found several stored 
incoming and outgoing calls and text messages. The forensic image showed HANSEN began 
using this smartphone during his travel to the PRC in February of 2015, shortly before he 
contacted the FBI and reported the alleged recruitment pitch by the PRCIS. The forensic image 
from July 11, 2017 revealed consistent communication to and from a contact identified in the 
smartphone as “Martin Chen,” beginning with HANSEN’s trip to the PRC in December of 2016 
and including each subsequent trip to the PRC prior to this outbound travel. Those trips occurred 
in February of 2017, April of 2017, and May of 2017. 

56. When CBP questioned HANSEN about the $53,000 in U.S. currency that he declared 

upon his return travel from the PRC on December 14, 2015, HANSEN explained that he sold a 

> 

piece of computer forensic equipment to Martin Chen of the MRS. On February 23, 2017, when 
describing his meetings with the MSS in the PRC, HANSEN told the CHS that the MSS always 
knows he is coming to the PRC, adding that they do not call themselves the MSS, they call 
themselves the MPS. 

57. During his voluntary meetings with the FBI in 2015, HANSEN explained his extensive 
interaction with the MPS. The court-authorized search of HANSEN’s MacBoolc Pro computer in 
April of 2016 revealed photographs saved to the computer depicting HANSEN with uniformed 
MPS officers, including some in a room with the MPS logo on the wall of the room, confirming 
admissions he made to the CHS about having ties to the MPS. 

58. During a meeting with CHS in April of 2018, as they discussed how they could 
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communicate to avoid detection, HANSEN suggested to CHS they use a covert means of 

communication using email. 

Movement of Money From the PRC to the United States 

59. HANSEN did not travel to the PRC during 2012, but he resumed frequent travel to the 
PRC in April 2013 . Since 2013 and through the date of this Complaint, HANSEN traveled to the 
PRC 40 times. 

60. Since at least April of 2013, HANSEN’s return from travel to the PRC coincided with 
him receiving large amounts of money. HANSEN moved money from the PRC to the U.S. using 
three methods: physically carrying cash across the border after trips to the PRC, Visa card 
transactions originating from the PRC, and wire transfers originating from the PRC. 

61. Since 2008, Amy and Robert operated a PRC-based entity called Beijing Hua Heng 
Infosec Company (Infosec) which partnered with H-l 1 to sell computer forensic products in the 
PRC. During the course of the partnership, H-l 1 shipped computer forensic products to Infosec. 

Eor example, email correspondence in August of2013 between HANSEN’s @ac-fps.eom email. 

account and an email account @hl ldfs.com provide shipping details for a product shipped 
internationally on or about August 8, 2013 from a domestic vendor to Infosec in Beijing. An 
analysis of bank records revealed that Amy and Robert paid for these products via wire 
transactions originating from the PRC to H-l 1 business accounts in the United States. In 
contrast, beginning in May of 2013, Amy and Robert began wiring funds to an AC-FPS business 
account controlled by HANSEN on dates that coincided with HANSEN’s trips to the PRC. 

62. For example, HANSEN traveled to the PRC on August 5, 2013, and he returned to the 
U.S. on August 27, 2013. On or about August 19, 2013, HANSEN sent an email from his @ac- 
ips.com email account to Amy and Robert at their @ac-fps.com email accounts asking Robert if 
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he received $15,000 U.S. dollars from HANSEN’s driver in the PRC. HANSEN then instructed 


Robert to send the money to his AC-FPS business account in Utah. On or about August 28, 
2013, HANSEN received a $14,985 wire originating from the PRC in his AC-FPS business 
account. 


63. Starting in May of 2013 through June of 2014, HANSEN’s travel to the PRC coincided 
with large cash deposits to HANSEN’s personal and business accounts without declarations of 
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64. After his interdiction by CBP on July 9, 2014, HANSEN began declaring U.S. currency 
on a regular basis upon his return from the PRC. HANSEN’s travel to the PRC from June 2014 
through December 2015 similarly coincided with large cash deposits to HANSEN’s personal and 
business accounts, as set forth in Table 2 below: 
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65. In conversations with law enforcement officials and others, HANSEN offered varying 
explanations regarding the source of his cash. For example, HANSEN claimed to CBP and FBI 
on at least one occasion that the cash related to the sale of surplus inventory and equipment 
following the 2013 closing ofH-11 Beijing. However, in March of 2015, HANSEN told the FBI 
that he no longer had surplus inventory and equipment to sell in the PRC. When questioned by 
CBP about cash carried into the U.S-., HANSEN never provided any documentation to confirm 
the sale of any surplus inventory or equipment from H-l 1 Beijing. As Tables 2 and 3 illustrate, 
HANSEN continued to bring significant sums of cash into the U.S. even after he advised CBP 
officers and FBI agents that little or no H-l 1 inventory or equipment remained to sell. 

66. After receiving scrutiny by CBP regarding his pattern of carrying cash into the U.S. 
following trips to the PRC, FIANSEN developed another method to transfer U.S. currency to his 


24 
































































Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 25 of 41 


U.S. bank accounts using credit cards. Curing a phone call with a business associate on or about 
June 10, 2016, HANSEN stated that he found “another way” to move money out of the PRC. 


HANSEN explained that the PRC government places an annual limit of $50,000 per individual. 

to transfer funds out of the PRC. To avoid the $50,000 limit, HANSEN further explained that an 

^ -9 

individual could transfer funds out of the PRC using credit cards. 

67. Emails confirm that, as early as March of 2016, HANSEN transferred money from the 
PRC using Visa cards with the assistance of Amy and Robert. The emails containing Visa card 
numbers included references such as “for Ron,” “Ron’s money,” and “Money In from RH.” 

Amy provided the Visa card numbers to both HANSEN and an accountant. Thereafter, at 
HANSEN’s direction, the accountant processed the Visa card transactions through U.S.-based 
merchant accounts and then transferred the funds to HANSEN’s personal and business accounts, 
as demonstrated in examples detailed below. 


68. HANSEN traveled to the PRC on July 17, 2016, and he returned to the U.S. on July 23, 


20T6. HANSEN did not declare any currency attliemiTpurt. When questioned by CBP~ 


HANSEN admitted carrying $9,970, an amount just under the reporting threshold. HANSEN 

i 

told CBP officers that he would no longer carry currency across the border and that he would 
instead have money sent to him via Visa card transactions. HANSEN told CBP the Visa card 


transactions would involve a 3% fee, but he would rather pay the fee than be interviewed by 


CBP. On or about July 24, 2016, Amy sent an email to HANSEN and the accountant stating that 
there was “USD15,000 in this visa card for Ron.” On July 27, 2016, the accountant processed 
the $15,000 Visa card transaction through the Nuvestack merchant account. 

69. HANSEN traveled to the PRC on December 3, 2016, and he returned to the U.S. on 
December 10, 2016. On or about December 12, 2016, in a telephone conversation with the 
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accountant, HANSEN described how he directed Amy and Robert to send $49,000 to the U.S. in 
increments of $10,000, $10,000, $15,000, and $14,000. On or about December 9, 2016, 

December 14, 2016, and December 22, 2016, Amysent emails to HANSEN and the accountant. 

with subject lines “Ron’s money” and “third part of Ron’s money.” At HANSEN’s direction, the 
accountant processed $49,000 total in Visa card transactions through the Nuvestack merchant 
account. 

70. On February 28, 2017, HANSEN told the CHS that the MSS always pays him in cash 
and he gives the cash to Amy and Robert to wire to him. HANSEN also told the CHS that he 
sometimes carries cash but he has to declare it if it is over $ 10,000. 

71. HANSEN traveled to the PRC on May 11,2017, and he returned to the U.S. on May 16, 
2017. On or about May 17, 2017, HANSEN spoke with Robert by telephone. Robert stated that 
HANSEN could access the money the following night. Robert said that he can only deposit 
5,000 U.S. dollars each day in the PRC, and it takes three days to deposit 15,000 U.S. dollars. 

On or about May 18, 20T77Amy sent an email to HANSEN and the accountant with subject line 

“money for Ron,” notifying them of the availability of $15,000 “for Ron” on a Visa card. On or 
about May 19, 2017, the accountant processed the $15,000 Visa card transaction through the 
Nuvestack merchant account. 

i 

f 

72. HANSEN traveled to the PRC on July 11, 2017 and he returned to the U.S. on July 18, 
2017. On or about July 19, 2017, Amy sent an email to HANSEN and the accountant stating that 
“there is USD9000 for Ron on this Visa card.” On or about July 20, 2017, the accountant 
processed the $9,000 Visa card transaction through the Nuvestack merchant account. 

73. HANSEN traveled to the PRC on September 21, 2017, and he returned to the U.S. on 
September 28, 2017. On or about September 28, 2017, HANSEN wrote in an email to a friend in 


26 















Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 27 of 41 


the PRC, “I have attached the Bank Information for the AC-FPS Business Group. Thank you. 
Hope to see you soon in Utah. Ron Hansen, CEO | AC-FPS Business Group.” The friend 
responded, “OK.” Oil September 29, 2017, bank records show that a wire originating from the " 
PRC in the amount of $9,985 posted to the AC-FPS business account. On or about October 2, 
2017, HANSEN, on a telephone call with a Nuvestack employee, explained the delay in paying 
the Nuvestack employee. HANSEN explained that the money was not “here” yet because 
“.. .they’ve gotta put some money in the bank.. .then put some money on a credit card that I can 
swipe here because the money’s coming from Asia.” On or about October 4, 2017, Amy sent an 
email to the accountant and HANSEN stating there was “USD30000 in this visa card for Ron.” 
On or about October 6, 2017, the accountant processed the Visa card through the Nuvestack 
merchant account. 

74. HANSEN traveled to the PRC on November 16, 2017, and he returned to the U.S. on 
November 21,2017. On or about November 16, 2017, during a telephone call, a business 
partner asked“HANSEN to repay a $50,000 loan. During a later call, 11 AN'S FN statecTthat he 
could not produce a $50,000 lump sum payment, but “there are some things aligning.” 

HANSEN stated he would probably get $10,000 to the business partner the following week. On 
or about November 22, 2017, HANSEN received a $27,985 wire originating from the PRC in his 
AC-FPS business account from the same friend referenced above. On or about November 22, 
2017, HANSEN transferred $10,000, through the Nuvestack business account, to this business 
partner. 

75. HANSEN traveled to the PRC on December 14,2017, and he returned to the U.S. on 
December 19, 2017. On or about December 22, 2017, Amy sent an email to HANSEN about 

j 

transferring money to HANSEN. Bank records show that on December 27, 2017, and January 3, 
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2018, two Visa card transactions were received in the Nuvestack business account in the 
amounts of $ 10,000 and $ 13,000 respectively. 

..76: Between July of 2016 and the date of this Complaint; - more than $200,000 was processed- 

through the Nuvestack merchant account from PRC bank-issued Visa cards provided by Amy 
and Robert. For tax year 2016, despite receiving approximately $90,000 through the Nuvestack 
merchant account using Amy and Robert’s Visa cards, Nuvestack failed to file any corporate tax 
filings with the Internal Revenue Service. 

77. For the merchant transactions, wires, and cash deposits described below in Table 3, 
HANSEN used the majority of the funds to benefit himself, his family members, and other 
entities, such as Nuvestack and AC-FPS, in which HANSEN held a vested financial interest. 

Rank records confirm that HANSEN did not transfer those funds to H-l 1 or use the funds in a 

i 

way that benefitted H-l 1. Table 3 illustrates the methods HANSEN employed to transfer U.S. 
currency from the PRC to the U.S., after scrutiny by CBP in December of 2015: 
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HBiiilHIlHI 

«»pSlSfpSi 

December 3 — 
December 10, 
2016 

None 

Seattle,WA 

December 12, 2016 

$10,000 

Card 

x4721 Nuvestack 

December 13, 2016 

$10,000 

December 16, 2016 

$15,000 
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December 19, 2016 

$1,000 

Cash 

x4798 Hansen personal 

December 23, 2016 

$14,000 

Card 

x4721 Nuvestack 


; ®S@W/AnU 


■MMMnai 

:V< ■- . ',-, 1 .C-"" ; .. ... ...„■ 


^lii^WsiSaaiBi 

imiM 

': t:S.19,O0Qi( 

11KSlii5i«S^ 

mgmm 
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April 9 - April 
17, 2017 

$2,500 
Seattle,WA 

April 18,2017 

$16,000 

Card 

x4721 Nuvestack 


ii*» 


|M MB 


;u- n ;. • 

July 11 - July 
18,2017 

None 

Seattle, WA 

July 2Q, 2017 

$9,000 

Card 

x4721 Nuvestack 

MtfHHiMi 

■Seattle. \Y \ 

IMMriwN 


111 1 ftSSl 

■ 

MHPHPMPWI 

•iiipi^iiii^iii 

•$mmdmmdmm 

i^ii*it®a§®8 

appp 

aRaWfflrrl iS l 
^\jStu2 JU Khm i 


November 16 - 
November 21, 
2017 

None 

Seattle,WA 

November 22, 2017 

$27,985 

Wire 

x6750 AC-FPS 

MjlMjP 
''^lo eob^rlbey^r t 

siwi!ftpa»iMPHS 


'•£ Jt t ih c cj (r-i&jsE vv^ff2 n iaTtVci S N9 ra >j |&jj *j*5 £2 ip ^ £ ?! 

V 

hmmmW 

flifiiiffPWwii 

fl*8t* 
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JiiiSfSi 


January 19 ~ 
January 24. 

2018 

$1,400 
Seattle,WA 

January 25, 2018 

$17,985 

Wire 

x6750 AC-FPS 

‘v u / ^ai ’6; ix$ 

*!? r-.t. ’ • T • ; • ‘uvU * ? P 



tipi# hP-#lf54%J#7;0 fifp 
I»MPW 

II^IB 

T'-W.ine# 

y Htf w=3^waUR> e^j 

^tn^fiStA Am 

April 5 to April 
10, 2018 

None 

Seattle,WA 

April 12, 2018 

$17,999 

Wire 

x6750 AC-FPS 
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Total: $369,799 


78. Tables 1-3 summarize some, but not all, of the U.S. currency HANSEN declared to CBP 
or funds deposited into U.S. bank accounts contemporaneous with his travel from the PRC. 



funds originating from the PRC. 


Export Control 


79. Under the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. §§ 1701 


















Under IEEPA, the President can declare a national emergency through Executive Orders that 
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carry the full force and effect of law. 

80. The Department of Commerce, Bureau of Industry and Security (DOC-BIS), regulated 
.the export of certain items, such as software witli cryptoanalytic capability, through the Export 

Administration Regulations (EAR), 15 C.F.R. §§ 730-774. Under the EAR, DOC-BIS imposed 
license and other requirements before a person could lawfully export an item subject to the EAR 
from the U.S. DOC-BIS references such items on the Commerce Control List, published at 15 
C.F.R. §774. 

81. On August 17, 2001, under the authority of IEEPA, the President issued Executive Order 
13222, which declared a national emergency with respect to the unrestricted access of foreign 
parties to U.S. goods and technologies. By successive Executive Notices, the President extended 
the finding of this national emergency and continued the EAR in effect under IEEPA, published 
most recently on August 15, 2017, at 82 Fed. Reg. 39,005. 

82. The Secretary of Commerce maintains the EAR, which identifies items over which DOC- 
BIS exe rcise s regu latory-jur isdiction. Through t he EAR, DOC-BIS imposes a license or o t h er— 

export authorization requirement before an item subject to the EAR may be lawfully exported 
from the United States or lawfully re-exported from another country. In particular, DOC-BIS 
places restrictions on the export of goods and technology that persons abroad might use to harm 
U.S. national security, foreign policy, and law enforcement interests. 

83. Under IEEPA and the EAR, willfully exporting, conspiring to export, attempting to 
export, or aiding and abetting the export from the U.S. of any item subject to the EAR that 
required a license without first obtaining the license from DOC constituted a crime. 

Sumuri Recon Software 

84. Sumuri LLC (Sumuri), a U.S. company located in Delaware, provided digital forensic 
training, software, hardware, and services. Sumuri manufactured the Recon Mac OS X 
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Forensics with Paladin 6 software (Sumuri Recon software). That software contained 
cryptographic capability. By at least June 1, 2016, the Sumuri Recon software received an 
Export Control Classification Number (ECCN) of 51)002.e.l. As a commodity controlled for 
anti-terrorism and national security reasons, the EAR prohibited the export of that controlled 

i 

commodity to the PRC without a valid export license from the DOC-BIS. 

85. On or about November 29, 2016, Amy requested that HANSEN purchase the Sumuri 
Recon software and bring it to her in the PRC. On or about December 12, 2016, HANSEN 
purchased the Sumuri Recon software for $1,717.95 purportedly on behalf of Nuvestack Inc., a 
U.S. company. On or about December 12, 2016, HANSEN directed an associate to ship the 
Sumuri Recon software to Am y in the PRC. On or about December 23, 2016, in an email 
message to HANSEN, Amy confirmed receipt of the Sumuri Recon software. HANSEN 
previously dealt with DOC-BIS and knew of the licensure requirement for export controlled 
products. HANSEN did not obtain the requisite license to export the Sumuri Recon software to 
the PRC. 

Vound Intella Software 

86. Yound LLC (Vound), a U.S. company located in Colorado, provided products related to 
forensic search, e-discovery, and information governance. Vound manufactured the Intella 100 

software. 

87. For the export of any commodity valued at or above $2,500, the EAR required the 
exporter to complete an Electronic Export Information form (EEI), previously known as 
Shipper’s Export Declaration (SED), in the Automated Export System (AES). Among other 
things, that form required the exporter to list the accurate value of the commodity (15 CFR 30). 
Electronic filing through the AES strengthened the U.S. government’s ability to prevent export 
of certain items to unauthorized destinations and to unauthorized users. 
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88. On or about December 23, 2016, Am y requested that HANSEN purchase the Intella 100 
Software and bring it to her in the PRC. On or about January 8, 2017, HANSEN purchased the 

Intella software from Vound for $3,030.00. After purchasing the software, HANSEN--— 

represented to the Vound sales manager that Nuvestaclc Inc. would be the end user of the 
product. Thereafter, HANSEN directed an associate to ship the Intella software to Amy in the 
PRC, and on or about January 19, 2017, the associate did so. At the request of Amy and with 
HANSEN’s knowledge, HANSEN’s associate listed the value of the product on the shipping 
documentation at $50.00, which HANSEN well knew to be false. HANSEN previously exported 
other products from the U.S. whose value exceeded $2,500. On those occasions, HANSEN 
submitted the requisite form, confirming that he knew of the disclosure requirement. HANSEN 
did not complete the EEI form regarding the export of the Intella software nor did he direct his 
associate to do so. 

The Confidential Human Source and Attempted Espionage 

89. As a routine investigative technique, the FBI enlists the participation of confidential 
human sources (CHS) to assist in investigations. 

90. On May 24, 2016, HANSEN met with two former DIA associates for lunch in San 
Antonio, Texas. After lunch, HANSEN continued to speak to one of the DIA associates, 
inquiring about DIA sources and methods of operation. During the conversation, HANSEN 
disclosed that the MSS approached him. He also described his meetings with the FBI and stated 
that he “had to give the MSS something to keep stringing them along,” while waiting for the FBI 
to make a decision about his offer to work as a “double agent.” 

91. Based on HANSEN’s statements, the DIA associate filed a suspicious incident report. 
Thereafter, with DIA approval, the associate agreed to assist the FBI in its investigation by 
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acting in the capacity of a CHS. At the time, the CHS worked as a DIA case officer. 

92. Between 2016 and 2018, the CHS spoke to HANSEN several times. During those 

i 

conversations', HANSEN disclosed ongoing contact with the MSS, including in-person meetings 
with senior MSS officers during his trips to the PRC. HANSEN stated that he performed 
consulting work for the MSS. HANSEN further stated that he sold computer forensic products 
to the PRCIS for which they “grossly overpaid” him in cash. 

93. In October of 2016, HANSEN told the CHS that the MSS was still willing to pay him 
$300,000 a year to do consulting work. HANSEN related that the MSS asked him to write white 
papers on cell phones. HANSEN also said the MSS asked him about the views of various U.S. 
politicians regarding the PRC. 

94. In February of 2017, HANSEN told the CHS that he attended intelligence and military 
conferences for the MSS. HANSEN stated that while none of the information at the conferences 
was classified, the MSS could not obtain the same information as'HANSEN because the MSS 
would not have the same access to high ranking military officials as HANSEN did. 

95. In March of 2018, HANSEN sent the CHS a copy of certain materials that he retained 

from his time as a U.S. government contractor. HANSEN asked the CHS to look for the v 

* 

information in intelligence reporting to determine how, if at all, the government used it. The 
materials that HANSEN sent to the CHS remained classified. 

96. In March of 2018, HANSEN also told the CHS that he met with a senior MSS 
intelligence officer during his March trip to the PRC. HANSEN discussed areas of interest 
expressed by the MSS intelligence officer about U.S. positions related to North Korea, South 
Korea, and the PRC. In addition to asking the CHS to look in intelligence reporting for 
information related to the materials HANSEN sent to the CHS, HANSEN also asked the CHS to 
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look in intelligence reporting for information on a specific issue HANSEN described related to 
North Korea. HANSEN also suggested he could act as a conduit to pass information to the MSS. 

97 ] n April of 2018, shortly before HANSEN travelled again to the PRC, HANSEN aiso 
discussed with the CHS his ability to facilitate the sale of national defense information to the 
PRCIS, saying he would meet with the MSS during his April trip to the PRC and assess their 
interest in information the CHS could obtain and provide. HANSEN discussed with the CHS 
ways to conceal their meetings and activities in the U.S. to avoid detection of their intent to sell 
national defense information to the PRCIS. 

98. Later in April of 2018, HANSEN again met with the CHS shortly after returning from the 
PRC. During the meeting, HANSEN discussed the details of how he and the CHS might sell 
national defense information to the PRCIS. HANSEN advised the CHS regarding the type of 
information the PRCIS would find useful, and HANSEN advised the CHS how to record and 
transmit classified infoimation without detection. HANSEN further suggested that the CHS 
create notes related to the content of any classified material that the CHS would pass to 

HANSEN. HANSEN also discussed the possibility of the CHS doing a debriefing with the 
PRCIS in Canada or Mexico. HANSEN asked what amount of compensation the CHS would 
require for providing such information. HANSEN advised that the PRCIS might pay up to 
$200,000 if the CHS could deliver the “China ops plan,” the operations plan of the United States 
military regarding potential military intervention with China. HANSEN explained how the CHS 
could hide and launder any funds received from the PRCIS, and HANSEN offered to help 
launder the money. On multiple occasions during the conversation, HANSEN asked whether the 
CHS was recording the meeting or “setting [HANSEN] up to go to jail.” At the end of the 
meeting, HANSEN discussed using an application that provides encrypted communication for 


34 










Case 2:18-mj-00324-PMW Document 1 Filed 06/02/18 Page 35 of 41 


their future interaction. 

99. In early May of 2018, after learning of the CHS’ unavailability to meet prior to 
HANSEN’S intended'travel'to'the PRC on May 31,2018, HANSEN suggested he could delay his 
travel to the PRC to a later date in order to accommodate the CHS ’ availability. 

100. HANSEN subsequently made plans to travel from Salt Lake City to the PRC on June 2, 
2018. He confirmed with CHS that they would meet at a location close the Seattle-Tacoma 
airport in Seattle, Washington, where HANSEN had a connecting flight to the PRC from the 
District of Utah. 

101. On June 2, 2018, during his layover, HANSEN took a cab to meet CHS at a pre- 

f 

arranged location close to the Seattle-Tacoma airport. CHS and HANSEN met in CHS’ car near 
the airport and drove to another location, also in the vicinity of the airport. CHS brought two 
classified paper documents with him (“materials”) to his meeting with HANSEN, both of which 
were classified at the secret level and marked accordingly. 

102. At the outset of the meeting HANSEN stated that he did not turn on his phone after he 
landed to insure that there would be no one tracking their location. CHS informed HANSEN 
that he had materials to show HANSEN. HANSEN initially responded to this news that he did 
not want to physically take the materials on his pending trip to the PRC. However, HANSEN 
later indicated that they should give his contacts in the PRCIS something to ensure that they 
would continue to work with CHS and HANSEN in the future. 

103. CPIS had the materials in a concealment device. CHS offered the materials in the 
device to HANSEN, who attempted to open the device but could not. CHS then took the device 
back, opened the device^ and asked HANSEN if he wanted to see the materials. HANSEN stated 
that he did and HANSEN then accepted the materials from CHS. 
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104. While reviewing the materials HANSEN indicated that each paragraph of the materials 

would be worth a separate ten-minute conversation with the PRCIS. CHS and HANSEN 

discussed the content of the materials for almost two hours. At one point, CHS asked HANSEN ' 

how he would remember all of their discussions and HANSEN stated that he would remember 

the highlights. CHS observed HANSEN take hand-written notes during their conversation. 

When CHS dropped off HANSEN, HANSEN indicated that he would take his hand-written 

notes and incorporate them into an existing Word document. During the majority of their two- 

hour meeting, HANSEN had the materials in his possession and reviewed them. HANSEN asked 

the CHS specific questions about the materials for the majority of their time together. At one 

point during the two hours, CHS left the car for between five and ten minutes. During this time, 

HANSEN continued to review the materials. 

» 

105. CHS and HANSEN also discussed how CHS should procure and store documents that 
CHS would obtain in the future for the PRCIS. HANSEN advised CHS that he should buy a 
computer and seamier and take steps to move the materials into a digital format. He also 
suggested that CHS cut a hole in a nearby tree and hide materials in that location. 

106. HANSEN also informed CHS that the PRCIS would have to vet CHS. HANSEN asked 
for CHS’ date of birth, email addresses, employment locations, his social media accounts, and 
information about CHS’ family members to provide to the PRCIS to facilitate the PRCIS vetting 
process. 

107. HANSEN told CHS that he would not receive money after this trip to the PRC. 
However, he advised CHS that he would arrange for CHS to receive payment after his next trip 
to the PRC later in June. HANSEN stated he would arrange for his contacts in the PRC to give 
the money to one of HANSEN’s business associates in the PRC who would then wire the funds 
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to one of HANSEN’s businesses. HANSEN would then have the funds “expensed” and arrange 
for them to be sent to CHS. 

-] 08. After their meeting, CHS dropped HANSEN off at a location-close to the Seattle-- 

Tacoma airport. HANSEN then walked approximately a block from the drop-off location toward 
the entrance to a pedestrian bridge that accessed the airport when he was apprehended by the 
FBI. 

109. When apprehended, HANSEN had in his possession a single page of hand-written 
notes. These notes included specific numbers from the materials that HANSEN incorporated into 

4- 

Utah phone numbers to mask their meaning. Additionally, the notes on the page included CHS ’ 

date of birth, email addresses, and employment locations. 

THE UNITED STATES COMPLAINS THAT: 

COUNT 1 
18 U.S.C. § 794(a) 

(Attempt to Gather or Deliver Defense Information) 

110. Paragraphs 1-109 of this Complaint are incorporated by reference and re-alleged as 

though set forth fully herein. 

111. On or about June 2, 2018, in the Northern Division of the District of Utah and 
elsewhere, 

RON ROCKWELL HANSEN, 

the defendant herein, did knowingly and unlawfully attempt to communicate, deliver and 
transmit directly and indirectly to a foreign government, to wit: the Government of the People’s 
Republic of China, and representatives, officers, agents, employees, subjects and citizens thereof, 
documents and information relating to the national defense of the United States including a 
document marked SECRET//NORFORN that related to military readiness in a particular region, 
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attempt to transport such currency from a place outside the United States to a place inside the 
United States, all in violation of 31 U.S.C. § 5332, as set forth below: 


mmm 
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November 26, 
2013 

None 

Seattle, WA 

November 26, 2013 

$9,000 

x4798 WF Hansen 
personal 


November 29, 2013 

$10,000 

x6750 WF AC-FPS 
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July 10, 2014 

$9,000 

x4798 WF Hansen 
personal 

5 

July 9,2014 

$19,222 in Detroit, MI 

July 11,2014 

$2,500 

X4892 WF K.H. 
personal 

(Form Filed) 

July 17, 2014 

$1,000 

x4798 WF Hansen 
personal 

. 



July 18,2014 

$1,800 

x4892 WF K.H. 
personal 


WF: Wells Fargo 


COUNTS 6-13 

31 U.S.C. § 5324 

(Structuring Monetary Transactions) 


11 6 Paragraphs 1-115 of the Complaint, are incorporated hy reference and re-alleged as set 

forth fully herein. 


117. Beginning on a date unknown to the United States, but at least by April 
2013, and continuing until the date of this Complaint, in the Northern Division of the District of 


Utah and elsewhere, the defendant, 


RON ROCKWELL HANSEN, 

did knowingly and for the purpose of evading the reporting requirements of Title 31, United 
States Code, Section 5313(a), and the regulations promulgated thereunder, structure and attempt 


to structure any transaction with one or more domestic financial institutions, as set forth below: 
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November 26, 
2013 


None 

Seattle, WA 


November 29, 2013 



8 


October 29, 
2014 


$27,775 in 
Seattle, WA 
(Form Filed) 


October 30, 2014 


November 7, 2014 



10 April 16, 2015 


$30,040 in 
Seattle, WA 
(Form Filed) 


April 17, 2015 


April 27,2015 


May 4,2015 



August 28, 2015 


12 


August 27, 
2015 


$20,267 in September 2, 2015 


Seattle, WA 
(Form Filed) 


September 3, 2015 


September 14, 2015 



$ 10,000 


$5,000 


$ 8,000 


$1,500 


$5,000 


$6,800 


$4,500 


$ 2,000 


$7,000 


"$27500" 


$2,900 


$3,000 


x6750 WF AC-FPS 


xl 730 BAF Hansen personal 


x4798 WF Hansen personal 


x4798 WF Hansen personal 


xl 730 BAF Hansen personal 


x4798 WF Hansen personal 


x!730 BAF Hansen personal 


x4798 WF Hansen personal 


xl730 BAF Hansen personal 


WF: Wells Fargo, BAF: Bank of American Fork 

And did aid and abet therein, all in violation of 31 U.S.C. § 5324 and 18 U.S.C. §2. 


COUNT 14 
18 U.S.C. § 554 

(Smuggling Goods from the United States) 

118. Paragraphs 1-117 of the Complaint are incorporated by reference and re-alleged as set 
forth fully herein. 
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119. From on or about November of 2016 through January of 2017, in the Northern Division 
of the District of Utah and elsewhere, the defendant, 

--RON ROCKWELL HANSEN,- 

and others known and unknown, fraudulently and knowingly did attempt to export and send from 
the United States, any merchandise, article, and object contrary to any law and regulation of the 
United States, and did attempt to receive, conceal, buy, sell, and facilitate the transportation, 
concealment, and sale of such merchandise, article, and object, prior to exportation, knowing the 
same to be intended for exportation contrary to any law and regulation of the United States, and 
aided and abetted the same, to wit, HANSEN did cause to be exported from the United States 
Sumuri Recon software containing password recovery capability without first having obtained 
the required licenses from the United States Department of Commerce, and did aid and abet 
therein, all in violation of 50 U.S.C. §§ 1702 and 1705, 18 U.S.C. §§ 554 and §2, and 15 C.F.R. 

§ 764.2(b). 

- COUNT 15 --- 

18 U.S.C. § 554 

(Smuggling Goods from the United States) 

120. Paragraphs 1-119 of the Complaint are incorporated by reference and re-alleged as set 
forth fully herein. 

121. From on or about December 23, 2016 through on or about January 19, 2017, in the 
Northern Division of the District of Utah and elsewhere, the defendant, 

RON ROCKWELL HANSEN, 

fraudulently and knowingly did attempt to export and send from the United States, any 
merchandise, article, and object contrary to any law and regulation of the United States, and did 
attempt to receive, conceal, buy, sell, and facilitate the transportation, concealment, and sale of 
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such merchandise, article, and object, prior to exportation, knowing the same to be intended for 
exportation contrary to any law and regulation of the United States, and aided and abetted the 
same, to wit, HANSEN' did cause to be exported from the United States Vound, Intella software 
with a falsified value, and did aid and abet therein, all in violation of 18 U.S.C. § 554 and §2, 13 
U.S.C. § 305, 15 C.F.R. §30.71, 15 C.F.R. §764.2(g). 

122. Based upon the foregoing information, your affiant respectfully requests that an arrest 
warrant be issued for Ron Rockwell Hansen for the above-referenced violations of federal law. 

DATED this 2nd day of JUNE, 2018. 



JONATHAN RUDD, Special Agent 
Federal Bureau of Investigation 


SUBSCRIBED and SWORN BEFORE ME this 2 nd day of June, 2018. 



PAUL M. WARNER, C hief Magistrate - Judg e 

United States District Court 


JOHN W. HUBER 
United States Atto 




Aa_ 

KARINFOJTIK 
Assistant United StatesAdtorney 
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